[PATCH] PM: Avoid TOCTOU race in pm_wakeup_irq_show()

[PATCH] PM: Avoid TOCTOU race in pm_wakeup_irq_show()

[ankun]

pm_wakeup_irq_show() reads the global pm_wakeup_irq variable twice:
first to check if it is zero (returning -ENODATA if so), and then again
to format the value for sysfs output. Between these two calls, the
wakeup IRQ could be cleared (e.g. by writing 0 to the same sysfs file),
leading to a time-of-check-to-time-of-use race. The result may be a
printed value of 0 despite the check having passed, or other
inconsistencies.

Cache the value in a local variable after a single read, and use that
for both the check and the output. This closes the race window and
makes the operation atomic from the caller's perspective.

Signed-off-by: ankun <ankun@uniontech.com>
---
 kernel/power/main.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/kernel/power/main.c b/kernel/power/main.c
index 5429e9f19b65..08a25117e38c 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -683,10 +683,12 @@ static ssize_t pm_wakeup_irq_show(struct kobject *kobj,
 					struct kobj_attribute *attr,
 					char *buf)
 {
-	if (!pm_wakeup_irq())
+	unsigned int irq = pm_wakeup_irq();
+
+	if (!irq)
 		return -ENODATA;

-	return sysfs_emit(buf, "%u\n", pm_wakeup_irq());
+	return sysfs_emit(buf, "%u\n", irq);
 }

 power_attr_ro(pm_wakeup_irq);
--
2.20.1